Security & governance
Data controller vs. data processor
Data controller vs. data processor is the distinction data protection law draws between two roles. The controller decides why personal data is processed and how. The processor handles the data on the controller's behalf and under its instructions. The distinction determines who is answerable to individuals and regulators, and what each party must do.
What defines a controller and a processor?
The test is who determines the purposes and the essential means of processing. A retailer that collects customer details to fulfil orders is a controller. The company that hosts the retailer's database, or sends its emails, acts as a processor. The roles are assigned by what an organization does in fact, and a contract cannot relabel a party that makes its own decisions about the data.
| Aspect | Controller | Processor |
|---|---|---|
| Decides purpose and means | Yes | No, follows documented instructions |
| Primary accountability to individuals | Yes | Limited |
| Must have a lawful basis | Yes | Relies on the controller's |
| Security obligations | Yes | Yes, directly under the law |
| May engage sub-processors | n/a | Only with the controller's authorization |
| Breach notification | To the regulator and, where required, individuals | To the controller, without undue delay |
Where do storage and cloud providers sit?
A provider that stores or processes personal data for a customer is normally a processor, and the customer remains the controller. The relationship has to be governed by a data processing agreement. Where an organization runs storage software on its own infrastructure, the software vendor typically has no access to the stored data and is not a processor for it, though support arrangements that involve access to systems or logs may change that and should be assessed.
Can an organization be both?
Yes. Roles attach to each processing activity. A cloud provider is a processor for the data its customers store and a controller for its own customer account and billing data. Two organizations that decide purposes and means together are joint controllers and must set out their respective responsibilities. A processor that uses customer data for its own purposes, beyond its instructions, becomes a controller for that use and takes on a controller's obligations.
Why does the distinction matter in practice?
It decides who answers access and erasure requests, who notifies a breach and who carries the main regulatory exposure. For the controller, it means choosing processors that offer sufficient guarantees and keeping oversight of them, which is where third-party risk management comes in. For the processor, it means acting only on instructions, keeping data secure and assisting the controller with its obligations.
Frequently asked questions
Is a storage provider always a processor?
Usually, when it holds personal data for customers. If it has no access to the data at all, as with software a customer runs itself, it may not be processing that data.
Who is liable if a processor causes a breach?
Both can be. The controller remains accountable, and the processor is liable where it failed its own obligations or acted outside instructions.
Does the same distinction exist outside the EU?
Many privacy laws use equivalent roles, sometimes under other names such as business and service provider.
Related terms
- GDPR: the regulation that defines the roles.
- Data processing agreement (DPA): the contract between controller and processor.
- Third-party risk management (TPRM): overseeing processors and their sub-processors.
- Data localization: where processing is allowed to take place.
- Extraterritorial data access: foreign legal reach over a processor.